System and method for distributed security forensics

Abstract

A host device and method for efficient distributed security forensics. The method includes creating, at a first host device configured to run a first virtualization entity, a first event index for the first virtualization entity; encoding at least one event related to the first virtualization entity; updating the first event index based on the encoded at least one event; and sending the first event index to a master console, wherein the master console is configured to receive a plurality of event indices created by a plurality of host devices with respect to a plurality of virtualization entities.

What is claimed is: 
     
       1. A method for efficient distributed security forensics, comprising:
 creating, at a first host device configured to run a first virtualization entity, a first event index for the first virtualization entity, wherein the first event index is an append-only event index, wherein the first event index records changes to the first event index; 
 encoding at least one event related to the first virtualization entity; 
 updating the first event index based on the encoded at least one event; and 
 sending the first event index to a master console, wherein the master console is configured to receive a plurality of event indices created by a plurality of host devices with respect to a plurality of virtualization entities. 
 
     
     
       2. The method of  claim 1 , wherein each event includes a process having a process path, wherein encoding the at least one event includes replacing at least a portion of each event with at least one code representing at least the process path of the respective process. 
     
     
       3. The method of  claim 1 , wherein the first event index is optimized with respect to write time, wherein the first event index is not optimized with respect to read time. 
     
     
       4. The method of  claim 1 , wherein the at least one event is encoded based on an event profile of the first virtualization entity, wherein the encoded at least one event is decoded by the master console based on the event profile of the first virtualization entity. 
     
     
       5. The method of  claim 4 , wherein the event profile of the first virtualization entity defines the encoding process used for encoding the event. 
     
     
       6. The method of  claim 4 , wherein the event profile of the first virtualization entity further includes the first event index. 
     
     
       7. The method of  claim 1 , wherein the first virtualization entity is any of: a software container, a plurality of software containers, and a lightweight virtual machine. 
     
     
       8. The method of  claim 1 , further comprising:
 compressing the at least one event. 
 
     
     
       9. The method of  claim 1 , wherein the at least one event includes at least one of: at least one networking event, and at least one filesystem access event. 
     
     
       10. The method of  claim 1 , wherein the first virtualization entity is any of: at least one container, a virtual machine, an image, a host operating system service, a user, a file, and a network interface. 
     
     
       11. A non-transitory computer-readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
 creating, at a first host device configured to run a first virtualization entity, a first event index for the first virtualization entity, wherein the first event index is an append-only event index, wherein the first event index records changes to the first event index; 
 encoding at least one event related to the first virtualization entity; 
 updating the first event index based on the encoded at least one event; and 
 sending the first event index to a master console, wherein the master console is configured to receive a plurality of event indices from a plurality of host devices configured to run a plurality of virtualization entities. 
 
     
     
       12. A host device for efficient distributed security forensics, wherein the host device is configured to run a first virtualization entity, comprising:
 a processing circuitry; and 
 a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: 
 create a first event index for the first virtualization entity, wherein the first event index is an append-only event index, wherein the first event index records changes to the first event index; 
 encode at least one event related to the first virtualization entity; 
 update the first event index based on the encoded at least one event; and 
 send the first event index to a master console, wherein the master console is configured to receive a plurality of event indices created by a plurality of other host devices with respect to a plurality of virtualization entities. 
 
     
     
       13. The host device of  claim 12 , wherein each event includes a process having a process path, wherein encoding the at least one event includes replacing at least a portion of each event with at least one code representing at least the process path of the respective process. 
     
     
       14. The host device of  claim 12 , wherein the first event index is optimized with respect to write time, wherein the first event index is not optimized with respect to read time. 
     
     
       15. The host device of  claim 12 , wherein the at least one event is encoded based on an event profile of the first virtualization entity, wherein the encoded at least one event is decoded by the master console based on the event profile of the first virtualization entity. 
     
     
       16. The host device of  claim 15 , wherein the event profile of the first virtualization entity defines the encoding process used for encoding the event. 
     
     
       17. The host device of  claim 15 , wherein the event profile of the first virtualization entity further includes the first event index. 
     
     
       18. The host device of  claim 12 , wherein the first virtualization entity is any of:
 a software container, a plurality of software containers, and a lightweight virtual machine. 
 
     
     
       19. The host device of  claim 12 , wherein the host device is further configured to:
 compress the at least one event. 
 
     
     
       20. The host device of  claim 12 , wherein the at least one event includes at least one of: at least one networking event, and at least one filesystem access event. 
     
     
       21. The host device of  claim 12 , wherein the first virtualization entity is any of:
 at least one container, a virtual machine, an image, a host operating system service, a user, a file, and a network interface.